This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-17407 →

DEBIAN-CVE-2018-17407

An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling o...

Original description

The description as published by the source.

An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 texlive-bin

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.20180907.48586-2"}]}]

Debian:13 texlive-bin

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.20180907.48586-2"}]}]

Debian:14 texlive-bin

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.20180907.48586-2"}]}]

References

advisory security-tracker.debian.org